CWE

Expression is Always False

ID: 570		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: DRAFT
Abstraction Type: Variant

Description

The software contains an expression that will always evaluate to false.

Applicable Platforms
Language Class: All

Time Of Introduction

• Implementation

Common Consequences

Scope	Technical Impact	Notes
Other	Quality degradation Varies by context

Detection Methods
None

Potential Mitigations

Phase	Strategy	Description	Effectiveness	Notes
Testing		Use Static Analysis tools to spot such conditions.

Relationships

Related CWE	Type	View	Chain
CWE-570 ChildOf CWE-885	Category	CWE-888

Demonstrative Examples   (Details)

1. In the following Java example the updateUserAccountOrder() method used within an e-business product ordering/inventory application will validate the product number that was ordered and the user account number. If they are valid, the method will update the product inventory, the user account, and the user order appropriately.
2. In the following example, the hasReadWriteAccess method uses bit masks and bit operators to determine if a user has read and write privileges for a particular process. The variable mask is defined as a bit mask from the BIT_READ and BIT_WRITE constants that have been defined. The variable mask is used within the predicate of the hasReadWriteAccess method to determine if the userMask input parameter has the read and write bits set.
3. In the following example, the updateInventory method used within an e-business inventory application will update the inventory for a particular product. This method includes an if statement with an expression that will always evaluate to false. This is a common practice in C/C++ to introduce debugging statements quickly by simply changing the expression to evaluate to true and then removing those debugging statements by changing expression to evaluate to false. This is also a common practice for disabling features no longer needed.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

Taxynomy	Id	Name	Fit
CERT C Secure Coding	MSC00-C	Compile cleanly at high warning levels
CERT C++ Secure Coding	MSC00-CPP	Compile cleanly at high warning levels

References:
None